Privacy Policy

Baseflare Solutions Ltd ("Baseflare", "we", "us", "our") operates the CasePilot platform. This Privacy Policy explains how we handle personal data when providing our services. We act primarily as a data processor on behalf of our customers, who remain the data controllers for their clients' personal data.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC094962.

1. Our Role

Baseflare Solutions Ltd acts as a data processor on behalf of our customers (mortgage brokers), who are the data controllers. We process personal data contained in documents only as instructed by our customers for the purpose of providing the CasePilot verification service.

For data relating to our customers' own accounts (login details, billing), we act as a data controller. Our registered company number is 15250772 and we are registered with the ICO under registration number ZC094962.

Contact: hello@baseflare.co.uk

2. What Data We Collect

Account Information

• •Name and email address
• •Organisation name
• •Billing information (processed by Stripe)

Documents Processed

• •Identity documents (passports, driving licences)
• •Financial documents (payslips, bank statements, tax documents)
• •Proof of address documents (utility bills, council tax)

These documents are uploaded by our customers (mortgage brokers) on behalf of their clients. The broker is responsible for obtaining appropriate consent from the data subject.

Usage Data

• •Login timestamps and session information
• •Feature usage and document processing history
• •Error logs for troubleshooting

3. How We Use Your Data

We process personal data for the following purposes:

• •Service delivery processing and verifying documents you upload
• •Account management managing your subscription and billing
• •Service improvement understanding usage patterns to improve the platform
• •Security detecting and preventing fraud or unauthorised access
• •Communication service notifications and support responses

4. Legal Basis for Processing

We process personal data under the following legal bases:

• •Contract processing necessary to deliver the service you have subscribed to
• •Legitimate interest service improvement, security monitoring, and fraud prevention
• •Legal obligation where we are required to retain data by law

5. Data Storage and Security

• ✓UK data residency all data is stored and processed within the AWS EU (London) region
• ✓Encryption at rest all stored data is encrypted using AES-256
• ✓Encryption in transit all connections use TLS 1.2 or higher
• ✓Tenant isolation each customer's data is logically and physically separated
• ✓Access controls role-based access with audit logging

6. Data Retention

• •Processed documents retained for the duration of your subscription plus 30 days after cancellation
• •Account data retained for 12 months after account closure for legal and audit purposes
• •Billing records retained for 7 years as required by UK tax law
• •Usage logs retained for 90 days

You may request earlier deletion of your data at any time (see section 9).

7. Third-Party Processors

We use the following third-party services to deliver CasePilot:

All third-party processors are bound by data processing agreements and are compliant with UK GDPR.

8. AI and Automated Processing

CasePilot uses AI to assist with document verification. Important points:

• •Documents are processed by AI for classification and data extraction only
• •No automated decisions are made about individuals based on document content
• •Your documents are not used to train AI models
• •See our Responsible AI Policy for more details

9. Your Rights

Under UK GDPR, you have the following rights:

• •Right of access request a copy of the personal data we hold about you
• •Right to rectification request correction of inaccurate data
• •Right to erasure request deletion of your personal data
• •Right to restrict processing request we limit how we use your data
• •Right to data portability receive your data in a structured, machine-readable format
• •Right to object object to processing based on legitimate interest

To exercise any of these rights, contact us at hello@baseflare.co.uk. We will respond within 30 days.

10. Cookies

The CasePilot application uses essential session cookies for authentication purposes only. We do not use advertising or tracking cookies. This marketing website does not set any cookies.

11. International Transfers

We do not transfer personal data outside the United Kingdom. All processing occurs within the AWS EU (London) region. Where third-party processors operate internationally, appropriate safeguards (Standard Contractual Clauses or UK adequacy decisions) are in place.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email to registered users. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

14. Contact Us

For any privacy-related queries, please contact us at hello@baseflare.co.uk.